A company runs applications in multiple AWS accounts in a single AWS Region.

Option A is correct because IAM Access Analyzer can use the AWS Organizations organization as the zone of trust and generate findings for resources shared with principals outside that trusted boundary. This directly addresses unintended external sharing and continuous monitoring of resource-based policies. EventBridge can notify security teams when Access Analyzer creates new findings. The aws:MultiFactorAuthPresent condition key in role trust policies enforces MFA when users assume cross-account IAM roles. Option B is weaker because AWS Config is not purpose-built for external access analysis, and aws:TokenIssueTime does not enforce MFA. Option C uses ExternalId, which helps third-party delegation but does not solve broad monitoring or MFA enforcement. Option D adds federation but does not directly provide the required resource-policy analysis and trust-policy MFA control.